I was on that Staking Marathon Scam website too. I had arround 90 XLM on my Ledger account. They said it is not enough. (I wanted to test it.) Days later I sent all my XLM (20k+) to my Ledger account. Now I have checked everything and know it is a scam.
When I connect now the Ledger, is it possible that hey have access to my account cause I was one time connected to them? Maybe they know through this my PK? Or does it also need the manual connection I surely never will give?